A multiplicity of Web pages can be browsed through the Internet due to the widespread use of the Internet. Information providing services of Web pages, etc., through the Internet are generally provided by a system called a Web 3-layer model. In the Web 3-layer model, a Web server that has received a request from a client apparatus invokes application software (hereinafter, simply “application”). The application invoked by the Web server invokes database management software (hereinafter, simply “database”). In this case, separate computers operate the Web server, the application, and the database in many cases.
In such a Web 3-layer model, it is not easy to survey the cause when there is a problem in performance, etc. One of the causes of the difficulty is that the software is dispersed into individual computers for operation. The problem is made more difficult because different developers make the software, and analyzing inside the processing of the software to search for the cause is virtually impossible.
To address such a problem, a system is proposed in which a message streaming on the network is observed to measure the required time in the Web server, the application, and the database for transactions. In such a system, the analyzing apparatus observes the network, and on the basis of the observed messages, generates a model (transaction model) of an invocation relationship between events.
The event denotes a processing unit executed according to a request from a client or another server. The event ends after a response is returned to the sender of the request. Therefore, the start times and the end times of individual events can be recognized by extracting request messages and reply messages through the network. The invocation relationship between events is determined by the inclusion relation of the time zones of events executed by the invoker, the IP (Internet Protocol) address of the computer that executes the events of the invoker, and the IP address of the computer of the call target.
After generating a transaction model, the analyzing apparatus compares the observed messages and the transaction model to determine the generated transactions.
In this way, generating the transaction model in advance allows the classification of transactions executed through the network in operation. On the basis of the generation times of the messages included in the classified transactions, the processing time by each server can be calculated for each processing of the transactions.
To generate a transaction model, a plurality of consecutive events can be considered as a series of processings, and the processings can be put together to generate a transaction model. If a plurality of consecutive events are put together, events in which only the numbers of accesses to the database are different, such as account activity inquiries of bank account, can be considered identical. As a result, a searching processing of a transaction model that matches the content of a message streaming on the network can be made more efficient. Upon calculating the processing time of each server for each type of transaction, the transactions of the same type, in which only the numbers of data accesses are different, can be analyzed as one unity. The processing of treating an assembly of consecutive events as a series of processings and generating a group including the events is called grouping. The group generated in the grouping is determined as a processing within one transaction, and a transaction model including the group is generated.
An example of methods for determining whether to group a plurality of consecutive events when there are a plurality of events includes a method of comparing time intervals between events and a predetermined threshold. In the method, events continuously generated at time intervals within the threshold are determined as consecutive processings within one transaction, and the events are grouped. The reason that the group can be appropriately generated using the threshold is that it can be assumed that the time intervals between events of a series of processings within one transaction are sufficiently shorter than the time intervals between applications of another transaction.
However, an appropriate value of the threshold of the time intervals for grouping is not self-evident. If the set threshold is too short, an individual transaction model is generated from each of a plurality of transactions that should be grouped and belong to one transaction model. If the set threshold is too long, a plurality of events that should not be grouped are grouped, and a correct transaction model cannot be generated. Thus, some values are actually set as thresholds to attempt generating transaction models, and the threshold to be used subsequently is determined on the basis of the suitability of the generated transaction models. However, the attempt to generate such a transaction model requires much effort.
The disclosed technique has been made in view of the foregoing circumstances, and an object is to provide a technique that can automatically determine an appropriate threshold of time intervals used for the determination of grouping.